From 1238760940b60d24665eedd7a071b418ccc1de1d Mon Sep 17 00:00:00 2001 From: Aere Network Date: Thu, 1 Oct 2026 17:09:27 +0300 Subject: [PATCH] D-470 / AIP-22 erratum 2026-10-01: the verifier prints POST-QUANTUM CERTIFIED and says what a certificate proves (its signers sealed the block post-quantum, in some round) and what it does not (that the block was decided); SPEC and the anchor README qualified the same way --- SPEC.md | 14 ++++++++++++-- anchor/README.md | 4 +++- tools/verify-anchor.mjs | 14 ++++++++++---- 3 files changed, 25 insertions(+), 7 deletions(-) diff --git a/SPEC.md b/SPEC.md index 3615485..f5281fa 100644 --- a/SPEC.md +++ b/SPEC.md @@ -1,6 +1,6 @@ # Aere Network chain 2800: full protocol specification -Version: 1.2.0, written 2026-08-25, amended 2026-09-02 (section 2.6, D8, G11), 2026-09-05 (sections 2.6 and 3.1: the message-layer arming heights, the v2 hybrid certificate, the anchor interval schedule) and 2026-09-17 (sections 2.6 and 3.1: the four enforcement heights have passed, hybrid keys are live; the "emission only" qualification is dated history), and 2026-09-22 (sections 2.7 and 5.3: AIP-21 verifiable per-block post-quantum finality live on chain 2800; AIP-20 native post-quantum transactions armed for height 19,900,000, patches 0006 and 0007 added to the recipe). Scope: everything a third party needs to implement a client +Version: 1.2.0, written 2026-08-25, amended 2026-09-02 (section 2.6, D8, G11), 2026-09-05 (sections 2.6 and 3.1: the message-layer arming heights, the v2 hybrid certificate, the anchor interval schedule) and 2026-09-17 (sections 2.6 and 3.1: the four enforcement heights have passed, hybrid keys are live; the "emission only" qualification is dated history), and 2026-09-22 (sections 2.7 and 5.3: AIP-21 verifiable per-block post-quantum finality live on chain 2800; AIP-20 native post-quantum transactions armed for height 19,900,000, patches 0006 and 0007 added to the recipe), and 2026-10-01 (sections 2.7 and 3 and the table of formal results: dated notes after the AIP-21 and AIP-22 errata of that date; nothing removed). Scope: everything a third party needs to implement a client that follows chain 2800 from block 0 to the live head and validates what the network validates, without reading Aere source code. It specifies the follower (validation) protocol completely; it describes seal production only where a follower must understand it to validate. @@ -378,6 +378,12 @@ is history now. What remains classical is named in section 3.1. Normative for a validator-capable build; informative for a pure follower, which answers honestly that it has nothing to report. +Note added 2026-10-01 (AIP-21 erratum of that date): the seals this record counts carry no consensus +round and are kept by block hash across rounds, so the verdict `post-quantum` shows that at least the +commit quorum of distinct validators sealed the block post-quantum, in some round, not by itself that +the block was decided. The method, its fields and its values are unchanged. Below AIP-22 stage 5 a node +imports a block only with the ECDSA commit quorum of one round. + - Every validator keeps the Falcon-512 seals it hears on QBFT COMMIT messages (section 2.6) in a retention window of the last 256 heights, keyed by the canonical block hash (not by the QBFT message digest, which carries the round and differs from the on-chain hash for any block @@ -458,6 +464,10 @@ Falcon key can rewrite at most the tail since the last anchor, so fork depth <= block 20,746,736 (about 20 seconds at the measured rhythm; <= 128 blocks, about 75 seconds, from block 17,225,968 to block 20,746,736; <= 32 blocks, about 16 seconds, before that); rewriting anything below an anchor changes that anchor's parent hash, forces the anchor to be reproduced, and reproducing it requires Falcon signatures the adversary does not have. +Added 2026-10-01 (AIP-22 erratum of that date; derived, not exercised): the certificate's seals carry no +round, so if the validators had also sealed, at the height of the last anchor's parent, a block in a +round that did not decide it, those honest seals can certify an anchor over that block, and the +rewrite can reach the anchor's parent, one block deeper than the bound above. History below H remains protected by ECDSA alone, permanently (source: `anchor/consensus/common/.../PqAnchorConfig.java`, interval javadoc; `anchor/README.md`). @@ -999,7 +1009,7 @@ document `strategie/VERIFICARE-FORMALA-2026-08-24.md`): | Liveness post-GST: within f+1 rounds an honest proposer commits | SMT N=4..7 | `qbft_liveness_smt.py` | | Network partitions: no split-brain in any split; the minority side cannot commit; progress returns on heal | SMT parametric N=9 + unbounded; TLC N=4 EXHAUSTIVE (6 configs, 0 states left in queue) | `partition_safety_smt.py`, `QBFTPartition.tla` | | PQ anchor certificate acceptance is fail-closed (quorum, root, size, domain, rotation gates each individually load-bearing) | SMT N=9 | `pqfinality_smt.py`, `anchor_blocking_quorum_smt.py` | -| A round change on an anchor height cannot yield two different valid certificates; uniqueness comes from binding to the FINALIZED block, not from K (K=3 alone admits two, shown SAT) | SMT N=9 | `anchor_viewchange_smt.py` | +| A round change on an anchor height cannot yield two different valid certificates; uniqueness comes from binding to the FINALIZED block, not from K (K=3 alone admits two, shown SAT). Note added 2026-10-01: a property of the MODEL only; the shipped rule does not require the certified block to be the decided one, and the AIP-22 erratum of that date shows a valid certificate over a block no round decided | SMT N=9 | `anchor_viewchange_smt.py` | | Emergency ceiling only lowers K | SMT | `pqanchor_ceiling_monotonicity_smt.py` | | Registry rotation covers every height exactly once; index binding | SMT | `registry_rotation_coverage_smt.py`, `registry_index_binding_smt.py` | diff --git a/anchor/README.md b/anchor/README.md index 75acb90..96ed676 100644 --- a/anchor/README.md +++ b/anchor/README.md @@ -70,7 +70,9 @@ anchor itself; and a message without a valid seal is REFUSED from blocks 17,250, heights were set on all nine validators on 2026-09-05 and take effect as the chain reaches them; until each height passes, that message type is still accepted without a seal. What a quantum adversary cannot do at any height is rewrite history past the last anchor without also forging -Falcon-512 and SLH-DSA-SHA2-128s signatures. None of this has been audited by a third party. +Falcon-512 and SLH-DSA-SHA2-128s signatures (added 2026-10-01, AIP-22 erratum of that date: except at +the height of the last anchor's parent, if the validators had also sealed there a block in a round +that did not decide it; derived, not exercised). None of this has been audited by a third party. The threat it addresses is not "harvest now, decrypt later". A signature is public; there is nothing to harvest. The threat is **retroactive rewriting**: validator keys recovered later can be used to diff --git a/tools/verify-anchor.mjs b/tools/verify-anchor.mjs index cf204a5..4fbda95 100644 --- a/tools/verify-anchor.mjs +++ b/tools/verify-anchor.mjs @@ -430,9 +430,13 @@ let ok = 0, bad = 0, sealsTotal = 0, sealsValid = 0; // nemeritat: se numara separat si iese cu alt cod. let unmeasured = 0; // 2026-09-26: the most recent anchor whose certificate VERIFIED here (anchors are walked newest first). Its PARENT is the -// post-quantum finality point of the chain (AIP-15/22: the certificate signs the parent's commit message); printed in the -// summary so a stranger gets the answer to "which block is final" from this tool, not from our word. Nodes do not serve the -// finalized/safe tags on this chain yet (measured 2026-09-26: eth_getBlockByNumber("finalized") answers "Unknown block"). +// block the certificate's seals signed (AIP-15/22: the certificate signs the parent's commit message); printed in the summary +// so a stranger reads from this tool, not from our word, which block the newest verified certificate covers. Nodes did not serve +// the finalized/safe tags on this chain then (measured 2026-09-26: eth_getBlockByNumber("finalized") answered "Unknown block"). +// 2026-10-01 (AIP-22 erratum of that date): this comment and the summary line called that parent the chain's "post-quantum +// finality point" and printed it on a FINALIZED line. The commit seal carries no round, so a certificate shows that its +// signers sealed that block post-quantum, in some round, not that the block was decided; the line now says what was verified. +// The ANCHOR_REPORT keys below are unchanged (the AIP-23 verifier reads them). let newestOk = null; let newestParentHash = null; // the hash of block newestOk - 1 the verified seals signed (M(parent)), for ANCHOR_REPORT // ce scheme au fost CHIAR verificate: rezumatul final nu are voie sa numeasca o schema pe care nu a vazut-o @@ -702,7 +706,9 @@ console.log(all // 2026-10-01: the tail of this line said, on every chain, that a header between anchors carries only its proposer's seal. That is true only // where AIP-22 stage 5 is active (testnet 28001 from block 3,131,000); on chain 2800 headers between anchors still carry the validators' // classical ECDSA commit seals, and this tool printed the stage-5 sentence there on every run. It now says what it measured above. -if (newestOk !== null) console.log('FINALIZED (post-quantum): block ' + (newestOk - 1) + ', the parent of anchor ' + newestOk + ', the most recent anchor whose certificate verified here. Nothing between anchors is post-quantum final; ' +if (newestOk !== null) console.log('POST-QUANTUM CERTIFIED: block ' + (newestOk - 1) + ', the parent of anchor ' + newestOk + ', the most recent anchor whose certificate verified here:' + + ' the validators whose seals it carries sealed that block post-quantum. The seals carry no consensus round, so this does not by itself prove' + + ' that the block was decided (AIP-22 erratum, 2026-10-01). Between anchors no block carries a post-quantum certificate; ' + (propChecked === 0 ? 'a header between anchors carries the validators\' classical ECDSA commit seals (AIP-22 stage 5 is not active at these heights on this chain).' : 'a header between anchors carries only its proposer\'s seal.'));